prole/etc/init_kong.sh

#!/usr/bin/env bash

set -euo pipefail

# init_kong.sh
# Purpose:
# - Deploy Kong API Gateway (DB-less) into the service namespace
# - Replaces the prole nginx deployment as the API endpoint
# - Routes /backup/* to knoe-db-manager
# - Creates the kong declarative config as a ConfigMap
# - Applies the kong deployment and service manifests
# - Provides start/stop/status/restart actions

SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)

# Shared option parsing for common core scripts
# shellcheck disable=SC1090
source "$SCRIPT_DIR/common_core_lib.sh"

# Inject default config if not provided
_has_config=0
for _arg in "$@"; do
  [[ "$_arg" == "-c" || "$_arg" == "--config" || "$_arg" == -c=* || "$_arg" == --config=* ]] && _has_config=1
done
if [[ $_has_config -eq 0 && -f "$SCRIPT_DIR/../conf/prole.cfg" ]]; then
  set -- "-c" "$SCRIPT_DIR/../conf/prole.cfg" "$@"
fi
unset _has_config _arg

common_core_preparse_config "$@"

# shellcheck disable=SC1090
source "$SCRIPT_DIR/prole_cfg.sh"

set -- "${COMMON_CORE_ARGS[@]}"
common_core_parse_args "$@"

if [[ -z "${PROLE_MODE:-}" ]]; then
  export PROLE_MODE="k3s"
fi

if [[ "${COMMON_CORE_HELP:-0}" == 1 ]]; then
  common_core_usage "$0"
  exit 0
fi

if [[ -n "${COMMON_CORE_PARSE_ERROR:-}" ]]; then
  echo "ERROR: ${COMMON_CORE_PARSE_ERROR}" >&2
  common_core_usage "$0"
  exit 2
fi

ACTION="$COMMON_CORE_ACTION"
NAMESPACE="$(common_core_resolve_namespace "default")"
common_core_apply_namespace "$NAMESPACE"

PROLE_HOME=${PROLE_HOME:-$(cd "$SCRIPT_DIR/.." && pwd)}
KONG_IMAGE="${KONG_IMAGE:-kong:3.9}"
KONG_NAME="${KONG_NAME:-prole-svc-kong}"
KONG_PROXY_PORT="${KONG_PROXY_PORT:-8000}"
KONG_ADMIN_PORT="${KONG_ADMIN_PORT:-8001}"
KONG_CONFIG_NAME="${KONG_CONFIG_NAME:-prole-svc-kong-config}"

# Public service entrypoint (single source of truth from prole.cfg via prole_cfg.sh)
SERVICE_HOSTNAME="${SERVICE_HOSTNAME:-svc.prole.org}"
SERVICE_TLS_SECRET_NAME="${SERVICE_TLS_SECRET_NAME:-${SERVICE_HOSTNAME//./-}-tls}"
SERVICE_TLS_CLUSTER_ISSUER="${SERVICE_TLS_CLUSTER_ISSUER:-letsencrypt-prod}"

# Auth front door hostname (CNAME to SERVICE_HOSTNAME per deployment expectation)
AUTH_HOSTNAME="${AUTH_HOSTNAME:-api.prole.org}"

# Legacy: svc-check used to own svc.prole.org. We now route the service hostname
# to Grafana, so remove any leftover svc-check resources to avoid conflicts.
SVC_CHECK_NAMESPACE="${SVC_CHECK_NAMESPACE:-svc-check}"

# kubectl robustness knobs (timeouts/retries for transient apiserver slowness)
KUBECTL_REQUEST_TIMEOUT="${KUBECTL_REQUEST_TIMEOUT:-30s}"
KUBECTL_APPLY_RETRIES="${KUBECTL_APPLY_RETRIES:-5}"
KUBECTL_APPLY_RETRY_DELAY="${KUBECTL_APPLY_RETRY_DELAY:-2}"

# Upstream service defaults
DB_MANAGER_SERVICE="${DB_MANAGER_SERVICE:-knoe-db-manager}"
DB_MANAGER_PORT="${DB_MANAGER_PORT:-80}"
PROLE_SERVICE_UPSTREAM_URL="${PROLE_SERVICE_UPSTREAM_URL:-http://prole-svc.knoe-db.svc.cluster.local:8080}"
GRAFANA_UPSTREAM_URL="${GRAFANA_UPSTREAM_URL:-http://kps-grafana.monitoring.svc.cluster.local:80}"

# SSO wiring knobs
PROLE_GRAFANA_SSO_ENABLED="${PROLE_GRAFANA_SSO_ENABLED:-0}"
GRAFANA_PROXY_UPSTREAM_URL="${GRAFANA_PROXY_UPSTREAM_URL:-http://prole-grafana-proxy.${NAMESPACE}.svc.cluster.local:80}"
KNOE_AUTH_UPSTREAM_URL="${KNOE_AUTH_UPSTREAM_URL:-http://knoe-auth.${SERVICE_NAMESPACE:-${NAMESPACE}}.svc.cluster.local:8080}"

usage() {
  cat <<USAGE
Usage: $0 [--mode MODE] [-n NAMESPACE] [${COMMON_CORE_ACTIONS//|/|}] [-c conf/prole.cfg]

Actions:
  start     Create ConfigMap and deploy Kong
  stop      Remove Kong deployment, service, and ConfigMap
  status    Show Kong pod/service status
  restart   Restart Kong pods
  update    Create or update Kong resources
USAGE
  exit 1
}

ensure_tools() {
  for t in kubectl; do
    command -v "$t" >/dev/null || { echo "Missing required tool: $t" >&2; exit 1; }
  done
}

ensure_namespace() {
  if ! kubectl get namespace "$NAMESPACE" >/dev/null 2>&1; then
    echo "Creating namespace '$NAMESPACE' ..."
    kubectl create namespace "$NAMESPACE" >/dev/null 2>&1 || true
  fi
}

kubectl_rt() {
  kubectl --request-timeout="$KUBECTL_REQUEST_TIMEOUT" "$@"
}

kubectl_apply_retry() {
  local attempt=1
  local delay="$KUBECTL_APPLY_RETRY_DELAY"
  while true; do
    if kubectl_rt apply "$@"; then
      return 0
    fi
    local rc=$?
    if [[ "$attempt" -ge "$KUBECTL_APPLY_RETRIES" ]]; then
      return "$rc"
    fi
    echo "WARN: kubectl apply failed (attempt ${attempt}/${KUBECTL_APPLY_RETRIES}); retrying in ${delay}s ..." >&2
    sleep "$delay"
    attempt=$((attempt + 1))
    delay=$((delay * 2))
  done
}

create_kong_config() {
  echo "Creating/updating Kong declarative config '$KONG_CONFIG_NAME' in namespace '$NAMESPACE' ..."

  local grafana_url
  grafana_url="$GRAFANA_UPSTREAM_URL"
  case "${PROLE_GRAFANA_SSO_ENABLED:-0}" in
    1|true|TRUE|True|yes|YES|on|ON)
      grafana_url="$GRAFANA_PROXY_UPSTREAM_URL"
      ;;
  esac

  local kong_yml
  kong_yml=$(cat <<KONGEOF
_format_version: "3.0"
_transform: true

services:
  - name: prole-service
    url: ${PROLE_SERVICE_UPSTREAM_URL}
    routes:
      - name: prole-k3s-kubeconfig
        paths:
          - /k3s/kube_config.sh
        strip_path: false

  - name: db-manager
    url: http://${DB_MANAGER_SERVICE}.${NAMESPACE}.svc.cluster.local:${DB_MANAGER_PORT}
    routes:
      - name: backup-route
        paths:
          - /backup
        strip_path: false

  - name: grafana
    url: ${grafana_url}
    routes:
      - name: grafana-root
        hosts:
          - ${SERVICE_HOSTNAME}
        paths:
          - /
        strip_path: false

  - name: knoe-auth
    url: ${KNOE_AUTH_UPSTREAM_URL}
    routes:
      - name: knoe-auth-root
        hosts:
          - ${AUTH_HOSTNAME}
        paths:
          - /
        strip_path: false
KONGEOF
)

  # Use a subshell to ensure the cleanup trap doesn't leak globally (and trip `set -u` later).
  (
    tmp="$(mktemp)"
    trap 'rm -f "${tmp:-}"' EXIT

    kubectl create configmap "$KONG_CONFIG_NAME" \
      --namespace="$NAMESPACE" \
      --from-literal=kong.yml="$kong_yml" \
      --dry-run=client -o yaml >"$tmp"

    kubectl_apply_retry -f "$tmp"
  )

  echo "ConfigMap '$KONG_CONFIG_NAME' ready."
}

cleanup_legacy_svc_check() {
  # Best-effort cleanup: older installs applied a static check page (svc-check)
  # that owned the service hostname via its own Ingress and injected routes into
  # the shared Kong declarative config ConfigMap.
  kubectl -n "$NAMESPACE" delete ingress svc-check-ingress --ignore-not-found >/dev/null 2>&1 || true
  kubectl delete namespace "$SVC_CHECK_NAMESPACE" --ignore-not-found >/dev/null 2>&1 || true
}

apply_service_ingress() {
  local host="${SERVICE_HOSTNAME:-}"
  if [[ -z "$host" ]]; then
    echo "WARN: SERVICE_HOSTNAME is empty; skipping service Ingress." >&2
    return 0
  fi

  local auth_host="${AUTH_HOSTNAME:-}"
  local tls_hosts_extra=""
  local rules_extra=""
  if [[ -n "$auth_host" && "$auth_host" != "$host" ]]; then
    tls_hosts_extra=$'\n        - '"${auth_host}"
    rules_extra=$(cat <<EOF
    - host: ${auth_host}
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: ${KONG_NAME}
                port:
                  number: ${KONG_PROXY_PORT}
EOF
)
  fi

  echo "Applying service Ingress for host '${host}' -> ${KONG_NAME}:${KONG_PROXY_PORT} (namespace=${NAMESPACE}) ..."
  (
    tmp="$(mktemp)"
    trap 'rm -f "${tmp:-}"' EXIT
    cat >"$tmp" <<EOF
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: svc-prole-ingress
  namespace: ${NAMESPACE}
  annotations:
    kubernetes.io/ingress.class: traefik
    traefik.ingress.kubernetes.io/router.priority: "10"
    cert-manager.io/cluster-issuer: ${SERVICE_TLS_CLUSTER_ISSUER}
spec:
  tls:
    - hosts:
        - ${host}
${tls_hosts_extra}
      secretName: ${SERVICE_TLS_SECRET_NAME}
  rules:
    - host: ${host}
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: ${KONG_NAME}
                port:
                  number: ${KONG_PROXY_PORT}
${rules_extra}
EOF
    kubectl_apply_retry -f "$tmp"
  )
}

deploy() {
  echo "Deploying $KONG_NAME to namespace '$NAMESPACE' ..."

  local manifests_dir="$PROLE_HOME/deploy/opentofu/k3s/manifests/prole"

  kubectl_apply_retry -f "$manifests_dir/kong-deployment.yaml" -n "$NAMESPACE"
  kubectl_apply_retry -f "$manifests_dir/kong-service.yaml" -n "$NAMESPACE"

  echo "Waiting for $KONG_NAME rollout ..."
  kubectl rollout status deployment/"$KONG_NAME" -n "$NAMESPACE" --timeout=120s

  # ConfigMaps do not trigger a Deployment rollout by default; always restart
  # Kong on update/start so it reloads the declarative config.
  echo "Restarting $KONG_NAME to reload declarative config ..."
  kubectl rollout restart deployment/"$KONG_NAME" -n "$NAMESPACE" >/dev/null 2>&1 || true
  kubectl rollout status deployment/"$KONG_NAME" -n "$NAMESPACE" --timeout=120s >/dev/null 2>&1 || true
  echo "$KONG_NAME deployed successfully."
}

stop() {
  echo "Removing $KONG_NAME from namespace '$NAMESPACE' ..."
  kubectl delete deployment "$KONG_NAME" -n "$NAMESPACE" --ignore-not-found=true
  kubectl delete service "$KONG_NAME" -n "$NAMESPACE" --ignore-not-found=true
  kubectl delete configmap "$KONG_CONFIG_NAME" -n "$NAMESPACE" --ignore-not-found=true
  echo "$KONG_NAME removed."
}

status() {
  echo "=== $KONG_NAME pods ==="
  kubectl get pods -n "$NAMESPACE" -l app="$KONG_NAME" 2>/dev/null || echo "No pods found"
  echo ""
  echo "=== $KONG_NAME service ==="
  kubectl get svc "$KONG_NAME" -n "$NAMESPACE" 2>/dev/null || echo "No service found"
}

restart() {
  echo "Restarting $KONG_NAME ..."
  kubectl rollout restart deployment/"$KONG_NAME" -n "$NAMESPACE"
  kubectl rollout status deployment/"$KONG_NAME" -n "$NAMESPACE" --timeout=120s
  echo "$KONG_NAME restarted."
}

action_update() {
  ensure_tools
  ensure_namespace
  cleanup_legacy_svc_check
  create_kong_config
  apply_service_ingress
  deploy
}

case "$ACTION" in
  start|initialize|update|reload)
    action_update
    ;;
  stop)
    ensure_tools
    stop
    ;;
  status)
    ensure_tools
    status
    ;;
  restart)
    ensure_tools
    restart
    ;;
  *)
    usage
    ;;
esac